*3.3. Analysis of NTL*

The collected SM data reflects the electricity consumption at a certain moment. For normal situation, SM data must follow the principle of electricity measurement mentioned above. On the contrary, anomaly SM data must break the regular law to reduce consumption randomly. Refer to the principle of electricity measurement, the primary types of NTL include:


**Figure 1.** Comparision of normal and Shunts by curves of voltages and currents.

**Figure 2.** Relationship between active power and power factor about phase inversion.

Overall, it is difficult to discover NTL among industrial customers only with SM data because the pattern of NTL mentioned above will be changed timely and randomly. Furthermore, it might be existed from the beginning, such as phase disorder. In contrast to the SMART attack defined in [11] or FDI5 defined in [10], the realistic NTL does not run in fixed artificial model and is more random and complicated. Consequently, the domain knowledge based features are very important for classifier to detect NTL.

### *3.4. Sample Model with Knowledge Embedding*

Before starting to train a deep neural network (DNN), it is necessary to model SM data as a suitable format. In [12], the electricity consumption is organized as a 1-D vector or 2-D matrix to feed DNN. It is different in that the SM data are multiple time series data. This paper tends to organize them as a vector with multiple channels. After comparing varying time span, we found weekly SM data has better performance. Hence, we choose week as the time span of sample and design a shifting window to construct different samples which shown in Figure 3a. The samples within same customer own the same label.

**Figure 3.** Structure of sample. (**a**) create samples based on shift window. (**b**) sample model embedded by knowledge.

In Section 3.3, we analyzed the complexity of NTL and came to the preliminary conclusion that only SM data is not enough to detect it. To further evaluating the linear separability of the samples based on pure SM data, we use t-SNE algorithm [31] to visualize samples and the result is shown in Figure 4a. There are lots of abnormal samples spread in the range of normal samples. They must lead to worse performance of NTL detection. To improve the linear separability of the samples, this paper attempts to embed electrical knowledge into the sample model. Based on principle of electricity measurement and phenomenon of NTL, we use the following parameters as additional channels:

$$\text{LU}\_{\text{imbalance}} = \frac{\max\left(\text{UL}\_{\text{A}\prime}\text{UL}\_{\text{B}\prime}\text{UL}\_{\text{C}}\right) - \min\left(\text{UL}\_{\text{A}\prime}\text{UL}\_{\text{B}\prime}\text{UL}\_{\text{C}}\right)}{\max\left(\text{UL}\_{\text{A}\prime}\text{UL}\_{\text{B}\prime}\text{UL}\_{\text{C}}\right)}\tag{5}$$

$$I\_{inbalance} = \frac{\max(I\_{A\prime}, I\_{B\prime}I\_{C}) - \min(I\_{A\prime}, I\_{B\prime}I\_{C})}{\max(I\_{A\prime}, I\_{B\prime}I\_{C})} \tag{6}$$

$$\hat{f} = \frac{P\_{total}}{\mathcal{U}\_A \cdot I\_A + \mathcal{U}\_B \cdot I\_B + \mathcal{U}\_C \cdot I\_C} \tag{7}$$

$$LR = \frac{\mathcal{U}\_A \cdot I\_A + \mathcal{U}\_B \cdot I\_B + \mathcal{U}\_C \cdot I\_C}{\text{Contracted } Apparent \, Power} \tag{8}$$

Finally, the sample is organized as multi-channel vector which is shown in Figure 3b. From Figure 4b, it is easy to find that the linear separability of the samples embedded knowledge is improved obviously, only few abnormal samples overlap with the normal samples.

**Figure 4.** t-SNE results of samples where 0 denotes normal samples plotted in blue, and 1 denotes NTL samples plotted in orange. (**a**) samples based on raw SM data. (**b**) samples based on raw SM data and electricity measurement knowledge.
